Your agent can do more. Find the skill that makes it happen.
Find your next superpower If you are an agent, refer to our llms.txt for full access.Exploit insecure handling of the HTTP Host header to poison password resets, generate cache poisoning vectors, or bypass internal routing restrictions. Use this skill when web applications dynamically generate URLs, links, or redirects based on the arbitrary Host header value supplied by the client rather than relying on a static, trusted server configuration.
Put the user in the hot seat — one question at a time until their plan, decision, or idea actually holds up. Use whenever the user says "hot seat me", "grill me", "stress-test this", "poke holes in this", "am I missing anything", or drops a plan and wants it challenged before anyone acts on it — even if they never say the words. Also used as a sub-procedure by the whiteboard and connotation-cop sk…
Use for "how does X work", code walkthroughs before changing something, and placement / ownership / layering questions ("where should this live", "which package owns this", "is this the right layer"). Explains subsystem architecture, runtime flow, onboarding mental models. Can critique architecture. Use why for motivation.
HTTP request smuggling exploits disagreements between a front-end proxy and back-end server on where one HTTP request ends and the next begins, using conflicting Content-Length and Transfer-Encoding: chunked headers (CL.TE, TE.CL, TE.TE variants). Enables bypassing access controls, cache poisoning, session hijacking, and capturing other users' requests. Detect via timing attacks, differential …
Identify and exploit HTTP Request Smuggling (HTTP Desync) vulnerabilities caused by discrepancies in how front-end proxies (load balancers, CDNs) and back-end servers parse the Content-Length and Transfer-Encoding headers. Use this to bypass security controls, hijack user sessions, and poison web caches.
Exploit advanced HTTP Request Smuggling combining Transfer-Encoding vulnerabilities (TE.TE). By obscuring the Transfer-Encoding header, an attacker forces desynchronization between a frontend proxy (which processes the request one way) and the backend server (which processes it another way), allowing the smuggling of malicious requests to bypass security controls or poison caches.
Provides patterns for HubSpot CRM integration, including OAuth authentication, CRM objects, associations, and custom objects. Covers batch operations, webhooks, and the Node.js and Python SDKs.
Explains OMG's StatusBar and TreeView workflow status surfaces in VS Code. Supports viewing workflow dashboards and current OMG status.
Explains template architecture and customization, including pages, content, partials, components, modules, and scripts. Covers styling with Tailwind v4, Bootstrap 5, or a verified hybrid setup.
Explicit user-invoked fallback for minimal de-AI surface editing that preserves meaning and voice.
Remove AI-isms and artificial language patterns from text. Makes documentation, comments, commit messages, and prose sound more natural and human. Based on Wikipedia's "Signs of AI writing" patterns.
Hunts for Active Directory credential and replication attacks — DCSync, Golden/Silver Ticket, and DCShadow — by analyzing directory-service-access (4662), Kerberos TGS (4769), and logon (4624) events for replication abuse and forged-ticket anomalies. Activates for requests to hunt DCSync, detect golden/silver tickets, or find Active Directory replication abuse.
Skills give your agent reusable instructions for a specific job. Pick one, read what it does, and bring it into your workflow.
A name only tells half the story. Search the full description and instructions to find the right fit.
Read the skill, visit its source, and see exactly what you’re adding to your agent.
Copy the install command from a skill page and run it in your project.
npx skillycli add owner/repo --skill name